AMENDMENTS TO THE CLAIMS 



(Currently Amended) A method to detect tampering with registry settings in a 
computer, comprising: 

generating by an application program running in the computer a user 

identity value associated with a user identit y that is authorized to change 

a system registry of the computer ; 

storing the user identity value; 

generating by the application program a registry security value associated 

with a- said system registry; 

storing the registry security value; and 

authenticating by the application program the system registry after 
reading the system registry , wherein authenticating includes at least one 
chosen from the group consisting of 

generating a now user identity value associated with a user identity 

and comparing the new user identity value to the stored user 

identity value, and 
obtaining an input responsive to a program attempting to access the 

system registry, the input allowing processing to continue . 

(Previously Presented) A method as in claim 1, wherein generating a user 
identity value associated with a user identity comprises inserting at least one of 
the username and password in a one-way function to obtain the user identity 
value associated with the user identity. 

(Previously Presented) A method as in claim 1, wherein generating a registry 
security value associated with a system registry comprises: 

concatenating system registry information; and 

inserting the concatenated system registry information in a one-way 

function to obtain the registry security value. 
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4. (Previously Presented) A method as in claim 3, wherein concatenating system 

registry information comprises concatenating at least one of system 
registry files and system registry handle keys. 

5. (Previously Presented) A method as in claim 1 wherein authenticating the 

system registry after reading the system registry further comprises: 
generating a new registry security value; 

comparing the new registry security value with the stored registry 
security value; and 

allowing processing to continue if the new registry security value is equal 
to the stored registry security value. 

6. (Previously Presented) A method as in claim 1 further comprising modifying the 

system registry in response to being provided the user identity value and 
the registry security value. 

Claims 7-9 (canceled). 

10. (Currently Amended) An article of manufacture comprising: 

a machine-accessible medium including instructions that, when executed by a 
machine, causes the machine to perform operations comprising 

generating a user identity value associated with a user identityjhatis 
authorized to access a system registry of said machine ; 
storing the user identity value; 

generating a registry security value associated with a-the_system registry; 
storing the registry security value; and 

generating a new user identity value associated with a new user identity 
seeking access to the system registry and comparing the new user 
identity value to the stored user identity value; 

authenticating the system registry after reading the system registry -; and 
applying a one-way function to the system registry settings as changed 
by the new user identity to obtain a new registry security value and 
storing the new registry security value for a subsequent authentication of 
the system registry w hercin authenticating includes at least one chosen 
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from the group consisting of 

generating a now user identity value associated with a user identity 

and comparing the now user identity value to the stored user 

identity value, and 
obtaining an input responsive to a program attempting to access the 

system registry, the input allowing processing to continue . 

11. (Previously Presented) An article of manufacture as in claim 10 wherein 

instructions generating a user identity value associated with a user 
identity comprises further instructions for inserting at least one of the 
user's usemame and password in a one-way function to obtain the user 
identity value associated with the user identity. 

12. (Previously Presented) An article of manufacture as in claim 10 wherein 

instructions for generating a registry security value associated with a 

system registry comprises further instructions for 
concatenating system registry information; and 
inserting the concatenated system registry information in a one-way 
function to obtain the registry security value. 

13. (Previously Presented) An article of manufacture as in claim 12, wherein 

instructions for concatenating system registry information comprises 
further instructions for concatenating at least one of system registry files 
and system registry handle keys. 

14. (Previously Presented) An article of manufacture as in claim 10 wherein 

instructions for authenticating the system registry after reading the 
system registry comprises further instructions for 
generating a new registry security value; 

comparing the new registry security value with the stored registry 
security value; and 

allowing processing to continue if the new registry security value is 
equal to the stored registry security value. 
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15. (Previously Presented) An article of manufacture as in claim 10 further 

comprising instructions for modifying the system registry in response to 
being provided the user identity value and the registry security value. 

Claims 16-18 (canceled). 

19. (Currently Amended) An apparatus comprising: 

a bus; 

a data storage device coupled to said bus and that stores a plurality of 
instructions which implement an application program ; and 
a processor coupled to said data storage device, said processor operable 
to receive said instructions which, when executed by the processor, cause 
the processor to 

generate a user identity value associated with a user identity that is 
authorized to change a system registry of said apparatus ; 
store the user identity value; 

generate a registry security value associated with a -said system 
registry; 

store the registry security value; and 
authenticate the system registry after reading the system registry based 
on the stored registry security value , wherein the authentication includes 
at least one chosen from the group consisting of 

generating a new user identity value associated with a user identity 
and comparing the new user identity value to the stored user 
identity value, and 
obtaining an input responsive to a program attempting to access the 
system registry, the input allowing processing to continue . 

20. (Previously Presented) An apparatus as in claim 19, wherein the processor 

operable to receive instructions which, when executed by the processor, 
cause the processor to generate a user identity value associated with a 
user identity comprises the processor to insert at least one of the 
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username and password in a one way function to obtain the user identity 
value. 

21. (Previously Presented) An apparatus as in claim 19, wherein the processor 

operable to receive instructions which, when executed by the processor, 

cause the processor to 

generate a registry security value associated with a system registry 
comprises the processor to concatenate system registry information; 
and 

insert the concatenated system registry information in a function to 
obtain the registry security value. 

22. (Previously Presented) An apparatus as in claim 21, wherein the processor to 

concatenate system registry information comprises the processor to 
concatenate at least one of system registry files and system registry 
handle keys. 

23. (Previously Presented) An apparatus as in claim 19 wherein the processor 

operable to receive instructions which, when executed by the processor, 
cause the processor to authenticate the system registry after reading the 
system registry further comprises the processor to 
generate a new registry security value; 

compare the new registry security value with the stored registry 
security value; and 

allow processing to continue if the new registry security value is 
equal to the stored registry security value. 

24. (Previously Presented) An apparatus as in claim 19 wherein the processor 

operable to receive instructions which, when executed by the processor, 
further causes the processor to modify the system registry in response to 
being provided the user identity value and the registry security value. 

Claims 25-28 (canceled). 
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29. (Currently Amended) An article of manufacture as in claim 10 wherein 

instructions for authenticating the system registry after reading the 
system registry comprises f urther comprising instructions for 

allowing processing to continue if the new user identity value is 

equal to the stored user identity value. 

30. Canceled. 
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